- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G1032 · 25 techniques
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0410 · inc-ransom
What it is
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Secureworks
- GOLD IONIC
- Other names
- Inc, Inc Group, INC ransomware, INC ransomware group, Inc., Inc. Ransom
Tools
The tools and malware families the sources tie to it.
- AdFind
- INC Ransomware
- INC Virus
- IncRansom
- Net
- Nltest
- PsExec
- Rclone
- Tor
- esentutl
Sources
- MITRE ATT&CK attack.mitre.org